CVE-2023-31045

2023-04-2400:00:00

mitre

github.com

text editors

formats

remote attackers

arbitrary web script

html

name parameter

content type

admin

xss payload

text formatting

security relevance

vendor dispute

AI Score

5.4

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security relevance of this finding because “any administrator that can configure a text format could easily allow Full HTML anywhere.”

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*"
    ],
    "vendor": "backdropcms",
    "product": "backdrop",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.24.2",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]